Loading vulnerability…
CVE-2023-40000 is an unauthenticated stored cross-site scripting vulnerability in the LiteSpeed Cache plugin for WordPress. The flaw affects versions prior to 5.7.0.1 and is caused by insufficient input sanitization and output escaping of user-controlled data, specifically involving the _msg parameter handled by the plugin's REST functionality. An attacker can submit crafted script content that is subsequently stored and later rendered in a victim's browser within the WordPress administrative or application context. Successful exploitation enables persistent script execution against users who view the affected content or interface.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
_msg field. Use a web application firewall or equivalent filtering to block obvious script injection attempts, and closely audit administrator activity, stored content, and user accounts for signs of compromise. These measures are temporary and do not replace upgrading to a fixed version.Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a proof-of-concept (PoC) exploit for CVE-2023-40000, a stored XSS vulnerability in the LiteSpeed Cache WordPress plugin (versions <5.7.0.1). The exploit consists of a Node.js Express server (index.js) that serves a malicious, obfuscated JavaScript payload (payload.js) at /admin-bar-reloaded.min.js and logs incoming data at /m. The README.md provides detailed vulnerability information, exploitation steps, and cURL commands for triggering the XSS via a POST request to the vulnerable WordPress REST API endpoint. The payload, when executed in a WordPress admin's browser, creates a new hidden admin user, removes evidence of the attack from the UI, and exfiltrates data to the attacker's server. The exploit is operational and demonstrates real-world post-exploitation impact, including privilege escalation and persistence. The repository is structured with standard Node.js project files, with the main logic in index.js and payload.js.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.